IBM WebSphere Application Server CVE-2017-1382 Local Security Bypass Vulnerability

Bugtraq ID:	99960
Class:	Design Error
CVE:	CVE-2017-1382
Remote:	No
Local:	Yes
Published:	Jul 26 2017 12:00AM
Updated:	Jul 26 2017 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	IBM Websphere Application Server 9.0 IBM Websphere Application Server 8.5 IBM Websphere Application Server 8.0 IBM Websphere Application Server 7.0
Not Vulnerable:

IBM WebSphere Application Server CVE-2017-1382 Local Security Bypass Vulnerability

IBM WebSphere Application Server is prone to a local security-bypass vulnerability.

Attackers can exploit this issue to bypass certain security restrictions or obtain sensitive information which may lead to further attacks.

IBM WebSphere Application Server versions 7.0, 8.0, 8.5, and 9.0 are vulnerable.

IBM WebSphere Application Server CVE-2017-1382 Local Security Bypass Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM WebSphere Application Server CVE-2017-1382 Local Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IBM WebSphere Application Server CVE-2017-1382 Local Security Bypass Vulnerability

References:

• IBM Homepage (IBM)
  
• WebSphere Application Server Homepage (IBM)
  
• swg22004785: WebSphere Application Server may have insecure file permissions (IBM)